diff --git a/.gitattributes b/.gitattributes
index 7ae8c20..911f95b 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +1,2 @@
 vendor/libetpan-1.8.tar.gz filter=lfs diff=lfs merge=lfs -text
-vendor/deltachat-core-master.tar.gz filter=lfs diff=lfs merge=lfs -text
+vendor/deltachat-core-0.35.0.tar.gz filter=lfs diff=lfs merge=lfs -text
diff --git a/.gitignore b/.gitignore
index 98e2c81..474ed82 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,5 +2,5 @@
 /libetpan.so
 /libdeltachat.so
 /libnetpgp.so
-/vendor/deltachat-core-master
+/vendor/deltachat-core-0.35.0
 /vendor/libetpan-1.8
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 0e56fb7..ee376c3 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -3,25 +3,24 @@ Debian 9:
   stage: build
   image: debian:stretch
   script:
+    # deltachat-core needs a later version of meson, fortunately it's in stretch-backports
+    - echo 'deb http://httpredir.debian.org/debian/ stretch-backports main' > /etc/apt/sources.list.d/stretch-backports.list
     - apt update
     # libetpan
     # FIXME: libetpan 1.16 is available in Debian, but we need 1.17+: https://github.com/deltachat/deltachat-core/issues/157
-    # TODO: it can take libcurl as well. Do we need it?
-    - apt install --no-install-recommends -yy build-essential autoconf automake libtool libdb-dev libexpat1-dev libsasl2-dev libssl1.0-dev
+    - apt install --no-install-recommends -yy -t stretch-backports build-essential autoconf automake libtool libdb-dev libexpat1-dev libsasl2-dev libssl1.0-dev
     - cd vendor && tar -xvzf libetpan-1.8.tar.gz && cd libetpan-1.8 && ./autogen.sh && ./configure && make && make install && cd ../..
     - cp /usr/local/lib/libetpan.so libetpan.so
     # deltachat-core
-    - apt install --no-install-recommends -yy meson ninja-build pkg-config zlib1g-dev libsqlite3-dev libsasl2-dev libssl1.0-dev libbz2-dev
-    - cd vendor && tar -xvzf deltachat-core-master.tar.gz && cd deltachat-core-master && mkdir builddir && cd builddir && meson && ninja && ninja install && cd ../../..
+    - apt install --no-install-recommends -t stretch-backports -yy meson ninja-build pkg-config zlib1g-dev liblockfile-dev libsqlite3-dev libsasl2-dev libssl1.0-dev libbz2-dev
+    - cd vendor && tar -xvzf deltachat-core-0.35.0.tar.gz && cd deltachat-core-0.35.0 && mkdir builddir && cd builddir && meson && ninja && ninja install && cd ../../..
     - cp /usr/local/lib/x86_64-linux-gnu/libdeltachat.so libdeltachat.so
-    - cp /usr/local/lib/x86_64-linux-gnu/libnetpgp.so libnetpgp.so
     # purple-plugin-delta
-    - apt install --no-install-recommends -yy libpurple-dev libcurl4-openssl-dev libglib2.0-dev
+    - apt install --no-install-recommends -t stretch-backports -yy libpurple-dev libcurl4-openssl-dev libglib2.0-dev
     - make
   artifacts:
     paths:
       - libetpan.so
       - libdeltachat.so
-      - libnetpgp.so
       - libdelta.so
 
diff --git a/vendor/deltachat-core-0.35.0.tar.gz b/vendor/deltachat-core-0.35.0.tar.gz
new file mode 100644
index 0000000..a0f641d
--- /dev/null
+++ b/vendor/deltachat-core-0.35.0.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5195615b3b2d9ad986571c946df8cbecc6dc9f487e60bbd7c269eed21a7a3e11
+size 8038952
diff --git a/vendor/deltachat-core-master.tar.gz b/vendor/deltachat-core-master.tar.gz
deleted file mode 100644
index 97ad98c..0000000
--- a/vendor/deltachat-core-master.tar.gz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:dd4628f680b06ca702bec2dc8953f66e97f4a39d2bec07b46674b0d248a663ee
-size 3041849